CISM Information Security Governance Practice Question
A CISO at a healthcare insurer is revising the information security strategy after a merger with a smaller regional provider. The board has asked how security will support the combined company's growth targets while protecting patient data. Which action BEST aligns the security strategy with the business objectives?
⚠ Common exam trap
The trap here is assuming that adopting the stricter policy or benchmarking peers automatically aligns security with business objectives, when alignment requires explicit mapping and executive validation.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Map security initiatives to the business goals and regulatory obligations of the merged entity, then validate them with executive stakeholders.
The correct answer is the one that maps security initiatives to business goals and regulatory obligations and validates them with executives. In CISM, information security governance requires that security strategy be aligned with business objectives and driven by top management. After a merger, the business context changes, so the CISO must ensure the strategy supports the new goals while meeting compliance requirements. Executive validation ensures the strategy is owned at the right level.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Map security initiatives to the business goals and regulatory obligations of the merged entity, then validate them with executive stakeholders.
Why this is correct
This is correct because CISM emphasizes that security strategy must be driven by and aligned with business objectives, not developed in isolation. In a merger, the business goals and regulatory landscape change, so mapping security initiatives to those goals and validating with executives ensures the strategy supports growth while addressing compliance. It also secures executive buy-in, which is critical for governance.
- ✗
Adopt the stricter of the two pre-merger security policies and enforce it across both organizations immediately.
Why it's wrong here
While harmonizing policies is necessary, simply adopting the stricter policy without aligning to the new business objectives can create unnecessary friction and may not address the merged entity's specific risks. It also ignores the need for executive validation and may not support growth targets. This approach is tactical and reactive rather than strategic.
- ✗
Delegate the development of a new security strategy to the IT operations team, since they understand the technical infrastructure.
Why it's wrong here
Delegating strategy to IT operations is a common pitfall. While IT operations provides valuable input, security strategy must be led by the CISO and aligned with business goals. IT operations typically focuses on day-to-day technical matters and may not have the broader business and regulatory perspective needed for a post-merger strategy.
- ✗
Benchmark the merged company's security program against industry peers and adopt their best practices.
Why it's wrong here
Benchmarking is useful, but adopting peer best practices without considering the merged company's unique business objectives, risk appetite, and regulatory obligations can lead to misalignment. It is an outside-in approach that may not address the specific growth targets and patient data protection needs of this organization.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CISM question from scratch — 924 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISACA exam blueprint
This CISM practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISM exam.